OCI Networking VCN - Connections to Various OCI Resources are Failing when Routing Through an OCI Firewall such as a Palo Alto or Fortinet Instance
(Doc ID 2850197.1)
Last updated on SEPTEMBER 12, 2022
Applies to:Oracle Cloud Infrastructure Virtual Networking - Version N/A to N/A
Information in this document applies to any platform.
When accessing OCI Resources, such as the Load Balancer, the Oracle Service Network (for example, OKE targets), etc. fail when routed through a firewall cloud instance such as a Palo Alto, Checkpoint or Fortinet/Fortigate. When bypassing the firewall and connecting directly to the resource, the connection is successful.
Symptoms can include hanging SSL connections, intermittent connectivity, or traffic working from certain subnets and not others - this can include traffic from on premises over one IPSEC/FastConnect tunnel, vs. another tunnel.
In one case a packet capture at the Palo Alto shows the Server Hello not reaching the Palo Alto from the resource during the SSL/TLS handshake negotiation, resulting in a hanging connection to the load balancer. This may also manifest itself in other traffic conversations where traffic is getting dropped at the firewall. Yet, typical Path Maximum Transmission Unit Discovery (PMTUD) troubleshooting does not show a problem with packet fragmentation in the path.
The firewall logs do not show any drops.
To view full details, sign in with your My Oracle Support account.
Don't have a My Oracle Support account? Click to get started!
In this Document